f.php

   1 <?php
   2 /*
   3  *  Jirafeau, your web file repository
   4  *  Copyright (C) 2008  Julien "axolotl" BERNARD <axolotl@magieeternelle.org>
   5  *  Copyright (C) 2015  Jerome Jutteau <j.jutteau@gmail.com>
   6  *
   7  *  This program is free software: you can redistribute it and/or modify
   8  *  it under the terms of the GNU Affero General Public License as
   9  *  published by the Free Software Foundation, either version 3 of the
  10  *  License, or (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU Affero General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU Affero General Public License
  18  *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19  */
  20 define('JIRAFEAU_ROOT', dirname(__FILE__) . '/');
  21
  22 require(JIRAFEAU_ROOT . 'lib/settings.php');
  23 require(JIRAFEAU_ROOT . 'lib/functions.php');
  24 require(JIRAFEAU_ROOT . 'lib/lang.php');
  25
  26 if (!isset($_GET['h']) || empty($_GET['h'])) {
  27     header('Location: ' . $cfg['web_root']);
  28     exit;
  29 }
  30
  31 /* Operations may take a long time.
  32  * Be sure PHP's safe mode is off.
  33  */
  34 @set_time_limit(0);
  35 /* Remove errors. */
  36 @error_reporting(0);
  37
  38 $link_name = $_GET['h'];
  39
  40 if (!preg_match('/[0-9a-zA-Z_-]+$/', $link_name)) {
  41     require(JIRAFEAU_ROOT.'lib/template/header.php');
  42     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') . '</p></div>';
  43     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  44     exit;
  45 }
  46
  47 $link = jirafeau_get_link($link_name);
  48 if (count($link) == 0) {
  49     /* Try alias. */
  50     $alias = jirafeau_get_alias(md5($link_name));
  51     if (count($alias) > 0) {
  52         $link = jirafeau_get_link($alias["destination"]);
  53     }
  54 }
  55 if (count($link) == 0) {
  56     require(JIRAFEAU_ROOT.'lib/template/header.php');
  57     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') .
  58     '</p></div>';
  59     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  60     exit;
  61 }
  62
  63 $delete_code = '';
  64 if (isset($_GET['d']) && !empty($_GET['d']) &&  $_GET['d'] != '1') {
  65     $delete_code = $_GET['d'];
  66 }
  67
  68 $crypt_key = '';
  69 if (isset($_GET['k']) && !empty($_GET['k'])) {
  70     $crypt_key = $_GET['k'];
  71 }
  72
  73 $do_download = false;
  74 if (isset($_GET['d']) && $_GET['d'] == '1') {
  75     $do_download = true;
  76 }
  77
  78 $do_preview = false;
  79 if (isset($_GET['p']) && !empty($_GET['p'])) {
  80     $do_preview = true;
  81 }
  82
  83 $p = s2p($link['md5']);
  84 if (!file_exists(VAR_FILES . $p . $link['md5'])) {
  85     jirafeau_delete_link($link_name);
  86     require(JIRAFEAU_ROOT.'lib/template/header.php');
  87     echo '<div class="error"><p>'.t('File not available.').
  88     '</p></div>';
  89     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  90     exit;
  91 }
  92
  93 if (!empty($delete_code) && $delete_code == $link['link_code']) {
  94     jirafeau_delete_link($link_name);
  95     require(JIRAFEAU_ROOT.'lib/template/header.php');
  96     echo '<div class="message"><p>'.t('File has been deleted.').
  97      '</p></div>';
  98     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  99     exit;
 100 }
 101
 102 if ($link['time'] != JIRAFEAU_INFINITY && time() > $link['time']) {
 103     jirafeau_delete_link($link_name);
 104     require(JIRAFEAU_ROOT.'lib/template/header.php');
 105     echo '<div class="error"><p>'.
 106     t('The time limit of this file has expired.') . ' ' .
 107     t('File has been deleted.') .
 108     '</p></div>';
 109     require(JIRAFEAU_ROOT . 'lib/template/footer.php');
 110     exit;
 111 }
 112
 113 if (empty($crypt_key) && $link['crypted']) {
 114     require(JIRAFEAU_ROOT.'lib/template/header.php');
 115     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') .
 116     '</p></div>';
 117     require(JIRAFEAU_ROOT.'lib/template/footer.php');
 118     exit;
 119 }
 120
 121 $password_challenged = false;
 122 if (!empty($link['key'])) {
 123     if (!isset($_POST['key'])) {
 124         require(JIRAFEAU_ROOT.'lib/template/header.php');
 125         echo '<div>' .
 126              '<form action = "';
 127         echo JIRAFEAU_ABSPREFIX . 'f.php';
 128         echo '" ' .
 129              'method = "post" id = "submit_post">'; ?>
 130              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 131         echo '<fieldset>' .
 132              '<legend>' . t('Password protection') .
 133              '</legend><table><tr><td>' .
 134              t('Give the password of this file') . ' : ' .
 135              '<input type = "password" name = "key" />' .
 136              '</td></tr>' .
 137              '<tr><td>' .
 138              t('By using our services, you accept our'). ' <a href="' . JIRAFEAU_ABSPREFIX . 'tos.php' . '">' . t('Terms of Service') . '</a>.' .
 139              '</td></tr>';
 140
 141         if ($link['onetime'] == 'O') {
 142             echo '<tr><td id="self_destruct">' .
 143                  t('Warning, this file will self-destruct after being read') .
 144                  '</td></tr>';
 145         } ?><tr><td><input type="submit" id = "submit_download"  value="<?php echo t('Download'); ?>"
 146         onclick="document.getElementById('submit_post').action='<?php
 147         echo JIRAFEAU_ABSPREFIX . 'f.php?h=' . $link_name . '&amp;d=1';
 148         if (!empty($crypt_key)) {
 149             echo '&amp;k=' . urlencode($crypt_key);
 150         } ?>';
 151         document.getElementById('submit_download').submit ();"/><?php
 152         if ($cfg['preview'] && jirafeau_is_viewable($link['mime_type'])) {
 153             ?><input type="submit" id = "submit_preview"  value="<?php echo t('Preview'); ?>"
 154             onclick="document.getElementById('submit_post').action='<?php
 155             echo JIRAFEAU_ABSPREFIX . 'f.php?h=' . $link_name . '&amp;p=1';
 156             if (!empty($crypt_key)) {
 157                 echo '&amp;k=' . urlencode($crypt_key);
 158             } ?>';
 159             document.getElementById('submit_preview').submit ();"/><?php
 160
 161         }
 162         echo '</td></tr></table></fieldset></form></div>';
 163         require(JIRAFEAU_ROOT.'lib/template/footer.php');
 164         exit;
 165     } else {
 166         if ($link['key'] == md5($_POST['key'])) {
 167             $password_challenged = true;
 168         } else {
 169             sleep(2);
 170             require(JIRAFEAU_ROOT.'lib/template/header.php');
 171             echo '<div class="error"><p>' . t('Access denied') .
 172             '</p></div>';
 173             require(JIRAFEAU_ROOT.'lib/template/footer.php');
 174             exit;
 175         }
 176     }
 177 }
 178
 179 if (!$password_challenged && !$do_download && !$do_preview) {
 180     require(JIRAFEAU_ROOT.'lib/template/header.php');
 181     echo '<div>' .
 182              '<form action="';
 183     echo JIRAFEAU_ABSPREFIX . 'f.php';
 184     echo '" ' .
 185              'method = "post" id = "submit_post">'; ?>
 186              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 187         echo '<fieldset><legend>' . htmlspecialchars($link['file_name']) . '</legend><table>' .
 188              '<tr><td>' .
 189              t('You are about to download') . ' "' . htmlspecialchars($link['file_name']) . '" (' . jirafeau_human_size($link['file_size']) . ').' .
 190              '</td></tr>' .
 191              '<tr><td>' .
 192              t('By using our services, you accept our'). ' <a href="' . JIRAFEAU_ABSPREFIX . 'tos.php' . '">' . t('Terms of Service') . '</a>.' .
 193              '</td></tr>';
 194
 195     if ($link['onetime'] == 'O') {
 196         echo '<tr><td id="self_destruct">' .
 197                  t('Warning, this file will self-destruct after being read') .
 198                  '</td></tr>';
 199     } ?>
 200         <tr><td><input type="submit" id = "submit_download"  value="<?php echo t('Download'); ?>"
 201         onclick="document.getElementById('submit_post').action='<?php
 202         echo JIRAFEAU_ABSPREFIX . 'f.php?h=' . $link_name . '&amp;d=1';
 203     if (!empty($crypt_key)) {
 204         echo '&amp;k=' . urlencode($crypt_key);
 205     } ?>';
 206         document.getElementById('submit_post').submit ();"/><?php
 207
 208         if ($cfg['preview'] && jirafeau_is_viewable($link['mime_type'])) {
 209             ?><input type="submit" id = "submit_preview"  value="<?php echo t('Preview'); ?>"
 210             onclick="document.getElementById('submit_post').action='<?php
 211         echo JIRAFEAU_ABSPREFIX . 'f.php?h=' . $link_name . '&amp;p=1';
 212             if (!empty($crypt_key)) {
 213                 echo '&amp;k=' . urlencode($crypt_key);
 214             } ?>';
 215         document.getElementById('submit_post').submit ();"/><?php
 216
 217         }
 218     echo '</td></tr>';
 219     echo '</table></fieldset></form></div>';
 220     require(JIRAFEAU_ROOT.'lib/template/footer.php');
 221     exit;
 222 }
 223
 224 header('HTTP/1.0 200 OK');
 225 header('Content-Length: ' . $link['file_size']);
 226 if (!jirafeau_is_viewable($link['mime_type']) || !$cfg['preview'] || $do_download) {
 227     header('Content-Disposition: attachment; filename="' . $link['file_name'] . '"');
 228 } else {
 229     header('Content-Disposition: filename="' . $link['file_name'] . '"');
 230 }
 231 header('Content-Type: ' . $link['mime_type']);
 232 header('Content-MD5: ' . hex_to_base64($link['md5']));
 233
 234 /* Read encrypted file. */
 235 if ($link['crypted']) {
 236     /* Init module */
 237     $m = mcrypt_module_open('rijndael-256', '', 'ofb', '');
 238     /* Extract key and iv. */
 239     $md5_key = md5($crypt_key);
 240     $iv = jirafeau_crypt_create_iv($md5_key, mcrypt_enc_get_iv_size($m));
 241     /* Init module. */
 242     mcrypt_generic_init($m, $md5_key, $iv);
 243     /* Decrypt file. */
 244     $r = fopen(VAR_FILES . $p . $link['md5'], 'r');
 245     while (!feof($r)) {
 246         $dec = mdecrypt_generic($m, fread($r, 1024));
 247         print $dec;
 248         ob_flush();
 249     }
 250     fclose($r);
 251     /* Cleanup. */
 252     mcrypt_generic_deinit($m);
 253     mcrypt_module_close($m);
 254 }
 255 /* Read file. */
 256 else {
 257     $r = fopen(VAR_FILES . $p . $link['md5'], 'r');
 258     while (!feof($r)) {
 259         print fread($r, 1024);
 260         ob_flush();
 261     }
 262     fclose($r);
 263 }
 264
 265 if ($link['onetime'] == 'O') {
 266     jirafeau_delete_link($link_name);
 267 }
 268 exit;
 269
 270 ?>